IBM / IBM-QRadar-Universal-Cloud-REST-API

These workflows are provided for sample usage, new submissions and updates from the community, and are NOT supported by IBM.
46 stars 94 forks source link

Digital Guard WORKFLOWS XML with Cookie Session Issue #73

Closed MohInteg closed 2 years ago

MohInteg commented 3 years ago

Hello ,

In order to collect event Oodrive.

I try to transform a script Python to an XML Script. Find here the script Python with tree steps Session cookies negociation, identification and finally authentication steps.

but when I try with for firt steps :

  <CallEndpoint url="https://sXXcXXpp.snc.oodrive.com/auth/ws/ClientXX/?service=user-home" method="GET" savePath="/get_events" >          
    </CallEndpoint>

Normally I need to get 4 value for Cookies : XSRF-TOKEN , SNC-auth and TS01759197, TS013be7c9 I have already tested yby Postman for example.

But I get only the last value for Cookies : "xxxxx Cookie":"TS013be7c9=01c xxxxxxxxxxxxxxxxxx". Qradar overwrites others previous values.

to get the session token , I need these values as paramaeters for the next steps.

Do you have any ideas how to get all details for value using XML Workflows ? there is any others parameters to be add in the request to have these details ? If I stored the response on a file on Qradar. Do you think can store all details with also first Session value ?

Thank you in advance for your assistance or ideas ?

import requests

Resource owner (enduser) credentials

RO_username='xxxxxxxxxxxx' RO_password='xxxxxxxxxxxx'

Environment infos

server = 'smxcxxpp.snc.oodrive.com' workspace= 'ClientXX'

Session cookie negociation

URL = "https://"+server+"/auth/ws/"+workspace+"/?service=user-home" login_url = "https://"+server+"/auth/steps/?service=user-home" client = requests.session()

Retrieve the CSRF token first

print('Retrieve the CSRF token first') client.get(URL) # sets cookie if 'XSRF-TOKEN' in client.cookies:

Django 1.6 and up

csrftoken = client.cookies['XSRF-TOKEN']

else:

older versions

csrftoken = client.cookies['csrf']

Identification step

print('Identification step') login_data={ 'username': RO_username , '_csrf': csrftoken} step = client.post(URL, data=login_data, headers=dict(Referer=URL))

Retrieve the CSRF token first on second step

if 'XSRF-TOKEN' in client.cookies:

Django 1.6 and up

csrftoken = client.cookies['XSRF-TOKEN']

else:

older versions

csrftoken = client.cookies['csrf']

Authentication step

print('Authentication step') login_data={ 'username': RO_username, 'password': RO_password, '_csrf': csrftoken} r = client.post(login_url, data=login_data, headers=dict(Referer=URL))

Retrieve saved cookies

print('Retrieve saved cookies') print(client.cookies.get_dict())

ChrisCollinsIBM commented 3 years ago

With each call you make you have access to the returned headers that you can extract to a local variable. Then on your next call you can include those as a header in the CallEndpoint parameters.

Here's an example of some headers being added to a CallEndpoint

https://github.com/ibm-security-intelligence/IBM-QRadar-Universal-Cloud-REST-API/blob/master/Okta/Okta-Workflow.xml#L17

In this example the token was provided, but some APIs will have you call some type of auth endpoint to give back a session ID, and also for things like the XSRF-TOKEN that likely comes back from the first or each call and must be carried through between calls.

Have a look at some of the sample workflows in the repository for what you're trying to do and if you need some more assistance then please attach the workflow file you're working on as well as links to the API docs for the product you're trying to integrate with so the community has some information to offer assistance.

ChrisCollinsIBM commented 2 years ago

Hi @MohInteg, have you had any luck in getting past the issue you were hitting?

ChrisCollinsIBM commented 2 years ago

Closing due to inactivity. Please re-open if needed.

Parismtl commented 2 years ago

Hi @MohInteg, I have the same problem as you, I would like to know if you would like to share some sample code that you have used for the capture of the XSRF-TOKEN, SNC-auth, it would be really appreciated. Thank you for your help. Best Regards

vvilaine commented 2 years ago

Hi @ChrisCollinsIBM , I'm Product Manager at Oodrive on API subjects, and I just got another request from one of our customer that has the same problem as @MohInteg. I'd like to get in touch with you regarding this problem, and see how we can investigate together to solve it, since it is a painpoint for several of our customers. You can reach me on linked in for private messaging : https://www.linkedin.com/in/vincent-vilaine-002b4b35/ Regards,

ChrisCollinsIBM commented 2 months ago

Just as a followup, Cookie support has been released in PROTOCOL-UniversalCloudRESTAPI-7.5-20240812075740.noarch.rpm and I've posted details here: https://github.com/IBM/IBM-QRadar-Universal-Cloud-REST-API/discussions/263